RatHat reads its own pairing code off the screen. When a computer asks to connect over Android's Wireless Debugging, the phone displays a six-digit number, and this trojan, already sitting on the device with accessibility permissions, simply reads the digits and pairs with the handset it is running on. No second machine is involved. The result is a shell-level session on the phone, outside the sandbox that is supposed to contain ordinary apps.
Researchers Gianluca Braga, Vishnu Pratapagiri and Fernando Ortega of Zimperium's zLabs published their analysis on September 16. What they describe steals banking logins, one-time passcodes and multi-factor codes, then goes after the screen-lock PIN itself.
The tapping is decided somewhere else
Most Android trojans follow a hardcoded script: tap here, scroll there, wait for that screen. RatHat does not. It serializes the phone's live accessibility tree, the structured description of everything on screen that assistive software reads, into XML and sends it to what Zimperium describes only as one of the world's most popular generative AI assistants. The assistant works out which coordinates to touch, pulls text off the screen and signals the next step.
That makes the attack path variable instead of fixed, which is the point of the design. Signature and rule based mobile security tools are looking for a known sequence of actions, and there is no longer a single one to find.
Reading a PIN off the glass
The most novel capability sits lower down. RatHat records raw touch coordinates straight from the input driver, where a finger physically lands rather than what the app draws, then matches them against a database of known keypad and pattern-lock layouts to rebuild PIN codes and unlock patterns. Android protections built to stop malware reading a sensitive screen never fire, because nothing is reading the screen. Zimperium counted three separate keylogging mechanisms in the sample.
It talks the user through every step it needs
Delivery is smishing and malicious advertising, leading to fake download pages dressed up as a popular streaming app or a browser such as Chrome, and ending in a sideloaded APK. Once installed, the app pressures the user into enabling Android's Accessibility Service with a fake network restriction warning or a bogus financial incentive. From there it taps through Developer Options by itself, turns on Wireless Debugging, self-pairs, and uses the resulting shell to drop two disguised native binaries: a Go based agent that runs system commands with elevated privileges, and a reverse-proxy client that holds a tunnel open back to the operator through firewalls and NAT. Overlay screens then harvest credentials from targeted apps, most of them financial, and the malware intercepts the SMS messages carrying the codes.
Uninstalling it is not enough
A hidden background service reinstalls the malware after removal, so cleaning an infected phone means a factory reset. The defensive advice is unglamorous and still works, because every link in this chain needs a person to agree to something: install only from Google Play or another official store, treat an accessibility request from an app with no accessibility purpose as hostile, and never turn on Developer Options or Wireless Debugging without knowing exactly why. Google's Advanced Protection Mode restricts which apps can ask for accessibility permissions at all, which cuts the chain at its first link.
Zimperium assesses that the operators appear to be working in China, an inference drawn from analyzing the prompts the malware sends rather than from infrastructure, so treat it as a lead rather than a finding. Indicators are published at the company's public IoC repository. Turning Android's own developer tooling into an escalation route is not new, RedHook pulled the same wireless-debugging trick in July, and this year's on-device fraud families, ToxicPanda 2.0 among them, have steadily moved the criminal workflow onto the victim's own handset. What RatHat adds is a decision-maker that does not ship with the malware. The write-up that surfaced the research notes that Malwarebytes detects the family as Android/Trojan.Exploit.RatHat.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.